Update hyperlight dependencies to 0.18.0

Cargo.toml

@@ -13,11 +13,11 @@ repository = "https://github.com/hyperlight-dev/hyperlight-wasm"
 readme = "README.md"
 
 [workspace.dependencies]
-hyperlight-common = { version = "0.17.0", default-features = false }
-hyperlight-component-macro = "0.17.0"
-hyperlight-component-util = "0.17.0"
-hyperlight-guest = "0.17.0"
-hyperlight-guest-bin = "0.17.0"
-hyperlight-host = { version = "0.17.0", default-features = false }
+hyperlight-common = { version = "0.18.0", default-features = false }
+hyperlight-component-macro = "0.18.0"
+hyperlight-component-util = "0.18.0"
+hyperlight-guest = "0.18.0"
+hyperlight-guest-bin = "0.18.0"
+hyperlight-host = { version = "0.18.0", default-features = false }
 hyperlight-wasm-macro = { version = "0.15.0", path = "src/hyperlight_wasm_macro" }
 hyperlight-wasm-runtime = { version = "0.15.0", path = "src/hyperlight_wasm_runtime" }

Justfile

@@ -18,7 +18,7 @@ make-vendor-tar:
 ensure-tools:
     cargo install wasm-tools --locked --version 1.235.0
     cargo install cargo-component --locked --version 0.21.1
-    cargo install wit-bindgen-cli --locked --version 0.43.0
+    cargo install wit-bindgen-cli --locked --version 0.58.0
     cargo install cargo-hyperlight --locked
 
 build-all target=default-target features="": (build target features) (build-examples target features) 

flake.nix

@@ -0,0 +1,304 @@
+{
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  inputs.nixpkgs-mozilla.url = "github:mozilla/nixpkgs-mozilla/master";
+  outputs = { self, nixpkgs, nixpkgs-mozilla, ... } @ inputs:
+    rec {
+      overlays.fix-rust = self: super: {
+        # Work around the nixpkgs-mozilla equivalent of
+        # https://github.com/NixOS/nixpkgs/issues/278508 and an
+        # incompatibility between nixpkgs-mozilla and makeRustPlatform
+        rustChannelOf = args: let
+          orig = super.rustChannelOf args;
+          patchRustPkg = pkg: (pkg.overrideAttrs (oA: {
+            buildCommand = (builtins.replaceStrings
+              [ "rustc,rustdoc" "librustc_driver-*.so" ]
+              [ "rustc,rustdoc,clippy-driver,cargo-clippy,miri,cargo-miri" "librustc_driver-*.{so,dylib}" ]
+              oA.buildCommand) + (let
+                wrapperPath = self.path + "/pkgs/build-support/bintools-wrapper/ld-wrapper.sh";
+                baseOut = self.clangStdenv.cc.bintools.out;
+                getStdenvAttrs = drv: (drv.overrideAttrs (oA: {
+                  passthru.origAttrs = oA;
+                })).origAttrs;
+                baseEnv = (getStdenvAttrs self.clangStdenv.cc.bintools).env;
+                baseSubstitutedWrapper = self.replaceVars wrapperPath
+                  {
+                    inherit (baseEnv)
+                      shell coreutils_bin suffixSalt mktemp rm;
+                    use_response_file_by_default = "0";
+                    prog = null;
+                    out = null;
+                  };
+              in ''
+                # work around a bug in the overlay
+                ${oA.postInstall}
+
+                # copy over helper scripts that the wrapper needs
+                (cd "${baseOut}"; find . -type f \( -name '*.sh' -or -name '*.bash' \) -print0) | while read -d $'\0' script; do
+                  mkdir -p "$out/$(dirname "$script")"
+                  substitute "${baseOut}/$script" "$out/$script" --replace-quiet "${baseOut}" "$out"
+                done
+
+                # TODO: Work out how to make this work with cross builds
+                ldlld="$out/lib/rustlib/${self.clangStdenv.targetPlatform.config}/bin/gcc-ld/ld.lld";
+                if [ -e "$ldlld" ]; then
+                  export prog="$(readlink -f "$ldlld")"
+                  rm "$ldlld"
+                  substitute ${baseSubstitutedWrapper} "$ldlld" --subst-var "out" --subst-var "prog"
+                  chmod +x "$ldlld"
+                fi
+              '');
+            passthru = (oA.passthru or {}) // {
+              toolchainVersionAttrs = args;
+            };
+          })) // {
+            targetPlatforms = [ "aarch64-linux" "x86_64-linux" "aarch64-darwin" ];
+            badTargetPlatforms = [ ];
+          };
+          overrideRustPkg = pkg: self.lib.makeOverridable (origArgs:
+            patchRustPkg (pkg.override origArgs)
+          ) {};
+        in builtins.mapAttrs (_: overrideRustPkg) orig;
+      };
+      gcroots =
+        let gcrootForShell = pkg: pkg // derivation (pkg.drvAttrs // {
+              origArgs = pkg.drvAttrs.args;
+              # assume the builder is bash for now (it always is for
+              # stdenv, which is the only thing that we will encounter
+              # in this flake).
+              args = [ "-c" "declare > $out" ];
+            });
+        in {
+          shells.x86_64-linux.default = gcrootForShell devShells.x86_64-linux.default;
+          shells.aarch64-linux.default = gcrootForShell devShells.aarch64-linux.default;
+        };
+      devShells = nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed (system: {
+        default = let pkgs = import nixpkgs {
+          inherit system;
+          overlays = [ (import (nixpkgs-mozilla + "/rust-overlay.nix")) overlays.fix-rust ];
+        }; in with pkgs; let
+          customisedRustChannelOf = args:
+            lib.flip builtins.mapAttrs (rustChannelOf args) (_: pkg: pkg.override {
+              targets = [
+                "x86_64-unknown-linux-gnu"
+                "x86_64-pc-windows-msvc" "x86_64-unknown-none"
+                "wasm32-wasip1" "wasm32-wasip2" "wasm32-unknown-unknown"
+                "aarch64-unknown-none" "aarch64-apple-darwin"
+              ];
+              extensions = [ "rust-src" ] ++ (if args.channel == "nightly" then [ "miri-preview" ] else []);
+            });
+
+          # Hyperlight needs a variety of toolchains, since we use Nightly
+          # for rustfmt and old toolchains to verify MSRV
+          toolchains = lib.mapAttrs (_: customisedRustChannelOf) {
+            stable = {
+              date = "2026-03-05";
+              channel = "stable";
+              sha256 = "sha256-qqF33vNuAdU5vua96VKVIwuc43j4EFeEXbjQ6+l4mO4=";
+            };
+            nightly = {
+              date = "2026-09-22";
+              channel = "nightly";
+              sha256 = "sha256-7qsyGDZErke6MdrngELbKaqs1Xgx8ols/e/HIygUIXg=";
+            };
+            "1.89" = {
+              date = "2025-08-07";
+              channel = "stable";
+              sha256 = "sha256-+9FmLhAOezBZCOziO0Qct1NOrfpjNsXxc/8I0c7BdKE=";
+            };
+          };
+
+          rust-platform = makeRustPlatform {
+            cargo = toolchains.stable.rust;
+            rustc = toolchains.stable.rust;
+          };
+
+          manifests = {
+            "Cargo.toml" = {
+            };
+            "src/tests/rust_guests/component_sample/Cargo.toml" = {
+            };
+            "src/tests/rust_guests/greeter_sample/Cargo.toml" = {
+            };
+            "src/tests/rust_guests/rust_wasm_samples/Cargo.toml" = {
+            };
+          };
+          manifestDeps = lib.mapAttrsToList (manifest: importArguments:
+            let lockPath = builtins.replaceStrings [ "toml" ] [ "lock" ] manifest; in
+            let lockFile = ./${lockPath}; in
+            rust-platform.importCargoLock ({
+              inherit lockFile;
+            } // importArguments)) manifests;
+          # when building a guest with cargo-hyperlight, or when
+          # building a miri sysroot for the main workspace, we need to
+          # include any crates.io dependencies of the standard library
+          # (e.g. rustc-literal-escaper)
+          stdlibLocks = lib.mapAttrsToList (_: toolchain:
+            "${toolchain.rust}/lib/rustlib/src/rust/library/Cargo.lock"
+          ) toolchains;
+          stdlibDeps = builtins.map (lockFile:
+            rust-platform.importCargoLock { inherit lockFile; }) stdlibLocks;
+          deps = pkgs.symlinkJoin {
+            name = "cargo-deps";
+            paths = stdlibDeps ++ manifestDeps;
+          };
+
+          # Script snippet, used in the cargo/rustc wrappers below,
+          # which creates a number of .cargo/config.toml files in
+          # order to allow using Nix-fetched dependencies (this must
+          # be done for the guests, as well as for the main
+          # workspace).  Ideally, we would just use environment
+          # variables or the --config option to Cargo, but
+          # unfortunately that tends not to play well with subcommands
+          # like `cargo clippy` and `cargo hyperlight` (see
+          # https://github.com/rust-lang/cargo/issues/11031).
+          materialiseDeps = let
+            sortedManifests = lib.lists.sort (p: q: p > q) (lib.attrNames manifests);
+            matchClause = path: ''  */${path}) root="''${manifest%${path}}" ;;'';
+            matchClauses = lib.strings.concatStringsSep "\n"
+              (builtins.map matchClause sortedManifests);
+          in ''
+            base_cargo() {
+              PATH="$base/bin:$PATH" "$base/bin/cargo" "$@"
+            }
+
+            manifest=$(base_cargo locate-project --message-format plain --workspace)
+            case "$manifest" in
+              ${matchClauses}
+            esac
+            if [ -f ''${root}/flake.nix ]; then
+
+              sed -i '/# vendor dependency configuration generated by nix/{N;N;N;N;N;d;}' $root/.cargo/config.toml
+              cat >>$root/.cargo/config.toml <<EOF
+            # vendor dependency configuration generated by nix
+            [source.crates-io]
+            replace-with = "vendored-sources"
+
+            [source.vendored-sources]
+            directory = "${deps}"
+            EOF
+
+              sed -i '/# vendor dependency configuration generated by nix/{N;d;}' $root/.git/info/exclude
+              printf "# vendor dependency configuration generated by nix\n%s\n" "/.cargo" >> $root/.git/info/exclude
+            fi
+
+            # libgit2-sys and cargo-hyperlight sysroot builds both end up
+            # copying vendored files into the target/ directory. If the
+            # files involved came from the Nix store, they will be readonly
+            # and a subsequent copy of the same file to the same place will
+            # fail. Hack around this issue by making any existing vendored
+            # files writable before a build can be run
+            find "$(base_cargo metadata --format-version 1 | jq -r '.target_directory')" \( -path '*/build/libgit2-sys-*/out/include' -or -path '*/sysroot/include' -or -path '*/libwit_bindgen_cabi*' \) -print0 | xargs -r -0 chmod u+w -R
+          '';
+
+          # Hyperlight scripts use cargo in a bunch of ways that don't
+          # make sense for Nix cargo, including the `rustup +toolchain`
+          # syntax to use a specific toolchain and `cargo install`, so we
+          # build wrappers for rustc and cargo that enable this.  The
+          # scripts also use `rustup toolchain install` in some cases, in
+          # order to work in CI, so we provide a fake rustup that does
+          # nothing as well.
+          rustup-like-wrapper = name: pkgs.writeShellScriptBin name
+            (let
+              clause = name: toolchain: ''
+                +${name}) base="${toolchain.rust}"; shift 1; ;;
+                +${name}-${toolchain.rust.toolchainVersionAttrs.date}) base="${toolchain.rust}"; shift 1; ;;
+              '';
+              clauses = lib.strings.concatStringsSep "\n"
+                (lib.mapAttrsToList clause toolchains);
+            in ''
+              base="${toolchains.stable.rust}"
+              ${materialiseDeps}
+              case "$1" in
+                ${clauses}
+                install) exit 0; ;;
+              esac
+              export PATH="$base/bin:$PATH"
+              exec "$base/bin/${name}" "$@"
+            '');
+          fake-rustup = pkgs.symlinkJoin {
+            name = "fake-rustup";
+            paths = [
+              (pkgs.writeShellScriptBin "rustup" "")
+              (rustup-like-wrapper "rustc")
+              (rustup-like-wrapper "cargo")
+            ];
+          };
+
+          buildRustPackageClang = rust-platform.buildRustPackage.override { stdenv = clangStdenv; };
+
+          # Keep the version in lockstep with the one pinned in the Justfile.
+          # `dev/update-cargo-hyperlight-version.sh` updates both.
+          cargo-hyperlight = let
+            version = "0.1.14";
+            # The .crate tarball is hashed flat, so the pin can be refreshed
+            # from the checksum crates.io publishes, without running Nix.
+            src = fetchurl {
+              url = "https://static.crates.io/crates/cargo-hyperlight/cargo-hyperlight-${version}.crate";
+              name = "cargo-hyperlight-${version}.tar.gz";
+              hash = "sha256-xS8cnUthc677Zv3C4+ES3bNZ/i+9uq/hubol96xXizk=";
+            };
+          in buildRustPackageClang {
+            pname = "cargo-hyperlight";
+            inherit version src;
+            # The tarball ships a Cargo.lock, so the dependencies need no
+            # vendor hash of their own.
+            cargoDeps = rust-platform.importCargoLock {
+              lockFile = runCommand "cargo-hyperlight-${version}-Cargo.lock" {}
+                "tar -xzOf ${src} cargo-hyperlight-${version}/Cargo.lock > $out";
+            };
+            doCheck = false;
+          };
+        in (buildRustPackageClang (mkDerivationAttrs: {
+          pname = "hyperlight";
+          version = "0.0.0";
+          src = lib.cleanSource ./.;
+          cargoDeps = deps;
+
+          nativeBuildInputs = [
+            azure-cli
+            just
+            dotnet-sdk_9
+            llvmPackages_18.llvm
+            gh
+            lld
+            pkg-config
+            ffmpeg
+            mkvtoolnix
+            wasm-tools
+            jq
+            jaq
+            gdb
+            zlib
+            cargo-hyperlight
+            cargo-component
+            typos
+            flatbuffers
+            cargo-fuzz
+            wit-bindgen
+          ] ++ (if system == "x86_64-linux" || system == "aarch64-linux"
+                then [ valgrind ]
+                else []);
+          buildInputs = [
+            pango
+            cairo
+            openssl
+          ];
+
+          auditable = false;
+
+          LIBCLANG_PATH = "${pkgs.llvmPackages_18.libclang.lib}/lib";
+          # Use unwrapped clang for compiling guests
+          HYPERLIGHT_GUEST_clang = "${clang.cc}/bin/clang";
+
+          RUST_NIGHTLY = "${toolchains.nightly.rust}";
+          # Set this through shellHook rather than nativeBuildInputs to be
+          # really sure that it overrides the real cargo.
+          postHook = ''
+            export PATH="${fake-rustup}/bin:$PATH"
+          '';
+        })).overrideAttrs(oA: {
+          hardeningDisable = [ "all" ];
+        });
+      });
+    };
+}

src/hyperlight_wasm/Cargo.toml

@@ -94,6 +94,7 @@ uuid = { version = "1.23.3", features = ["v4"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 semver = "1.0.28"
+bytes = { version = "1", default-features = false }
 
 [build-dependencies]
 cfg_aliases = "0.2.1"

src/hyperlight_wasm/examples/component_example/main.rs

@@ -50,7 +50,6 @@ impl bindings::component_sample::example::ExampleImports<hyperlight_common::comp
 fn main() {
     let state = State::new();
     let mut sb: hyperlight_wasm::ProtoWasmSandbox = hyperlight_wasm::SandboxBuilder::new()
-        .with_guest_input_buffer_size(70000000)
         .with_guest_heap_size(200000000)
         .with_guest_scratch_size(100 * 1024 * 1024)
         .build()